Burlison, Lee Reintroduce Legislation to Protect Vehicle Data and Personal Privacy

Washington, D.C. - Rep. Eric Burlison (R-MO-07) reintroduced the Auto Data Privacy and Autonomy Act, legislation to stop the unchecked collection, sale, and exploitation of personal data generated by modern vehicles. Sen. Mike Lee (R-UT) introduced companion legislation in the Senate.

As vehicles become increasingly connected, manufacturers now collect detailed and highly sensitive information, including location data, driving behavior, and biometric identifiers. Much of this data is gathered and monetized without clear disclosure or meaningful consent, leaving Americans exposed to surveillance, data brokers, and foreign adversaries.

The Auto Data Privacy and Autonomy Act establishes firm protections to ensure vehicle owners control their personal data and decide how it is used, shared, or deleted.

"Auto manufacturers have quietly turned cars into data-harvesting machines," Burlison said. "Drivers are being tracked, and their personal information is monetized with little transparency or consent. Your data should never be treated as a corporate asset or an open target for bad actors."

"Carmakers are collecting and selling personal data from millions of American drivers," said Senator Lee. "Your morning drive to work, your GPS location, and your driving habits could be sold to insurance companies, or even to international adversaries like China. Drivers deserve ownership of their data, so the Auto Data Privacy and Autonomy Act will enable them to see, delete, and opt out of having their privacy violated in the drive-through line."

Key provisions include:

• Data ownership and consent: Prohibits manufacturers from accessing or selling vehicle data without explicit, written consent from the owner.
• Limits on data sharing: Restricts disclosure to narrow circumstances such as emergencies or valid court orders.
• National security protections: Bars data transfers to entities tied to foreign adversaries
• Consumer access and deletion: Requires manufacturers to provide owners free access to their vehicle data and the ability to delete it.

A 2023 Mozilla Foundation study found that 92 percent of car brands give drivers little or no control over their personal data. Industry projections estimate vehicle data monetization could reach as much as $750 billion by 2030, creating powerful incentives for invasive data practices that undermine privacy.

"This bill draws a clear line," Burlison said. "Personal data belongs to the individual. Not to automakers. Not to data brokers. Not to foreign governments."

Bill Text Attached.

Organizational Support:

Richard Ward, Executive Director of AVOA

"We are excited about the reintroduction of the Auto Data Privacy and Autonomy (ADPA) Act, legislation aimed at ensuring that vehicle data remains with the vehicle owner, not the manufacturers. Motor vehicle fleet owners and operators provide a wide range of essential mobility services. Yet manufacturers are increasingly limiting access to vehicle-generated data, undermining the property rights of consumers and fleet operators alike. Vehicle owners must have access to and control over their vehicle-generated data, which is critical for privacy, safety, innovation, and fair market competition. This legislation represents a significant win for privacy, competition, and consumer choice. We look forward to working with Congress to protect American drivers."